Bump OpenIddict.Abstractions from 6.2.0 to 7.7.1

[dependabot]

Updated OpenIddict.Abstractions from 6.2.0 to 7.7.1.

Release notes

Sourced from OpenIddict.Abstractions's releases.

7.7.1

This release introduces the following changes:

• The identity token principal extracted from identity token hints is now correctly restored and returned by ASP.NET Core/OWIN's AuthenticateAsync() API when using pushed authorization requests, authorization request caching or end session request caching.

7.7.0

This release introduces the following changes:

• A vulnerability affecting the validation of audiences contained in client assertions by the OpenIddict server stack was identified earlier today (thanks @​x-redacted! ❤️) and fixed.

[!CAUTION]
Upgrading to OpenIddict 7.7 or 8.0 preview 4 is strongly advised. See GHSA-925x-4h4v-2792 for more information.

• On .NET 10 and higher, the OpenIddict.Quartz package now references the 4.0 version of Quartz.NET. See https://www.quartz-scheduler.net/documentation/quartz-4.x/migration-guide.html for more information about Quartz.NET 4.0.

[!IMPORTANT]
On .NET Framework and .NET Standard 2.0/2.1, the package keeps referencing the 3.x branch, as Quartz.NET 4.0 is only compatible with .NET 10 and higher.

• The aud claim in client assertions can now be represented as a JSON array, as allowed by the recent versions of the Updates to OAuth 2.0 JSON Web Token (JWT) Client Authentication and Assertion-Based Authorization Grants specification.

• The OpenIddict.Client.WebIntegration package now supports JoinRpg (thanks @​leotsarev! ❤️)

• grant_type=urn:ietf:params:oauth:grant-type:device_code token requests that don't include a client identifier are now rejected earlier by the OpenIddict server stack.

• The net9.0-android, net9.0-ios, net9.0-maccatalyst and net9.0-macos target framework monikers are no longer supported by Microsoft and have been removed from the OpenIddict.Client.SystemIntegration package and the OpenIddict metapackage. Users of the OpenIddict.Client.SystemIntegration package are invited to migrate to .NET 10.0.

• All the .NET and third-party dependencies have been updated to their latest version.

• The System.Interactive.Async dependency (used only on .NET Framework and .NET Standard) was downgraded to 3.2.0 to fix a TypeLoadException that prevented using the OpenIddict Entity Framework Core 2.3 stores on .NET Framework after migrating to OpenIddict 7.6.0.

7.6.1

This release introduces the following changes:

• The GitHub web provider was fixed to support the iss parameter now returned by GitHub. As part of this change, the issuer was also changed to https://github.com/login/oauth, which is the value now officially used by GitHub.

• The ReplaceDefault*Entity() methods exposed by OpenIddictMongoDbBuilder now register the stores as singleton services instead of scoped services.

• The client system integration was updated to always attach an IASWebAuthenticationPresentationContextProviding object to the ASWebAuthenticationSession on Mac Catalyst and macOS, matching the logic already used on iOS (thanks @​amirburbea for reporting this issue).

7.6.0

This release introduces the following changes:

• The Entity Framework 6.x and Entity Framework Core stores have been updated to automatically restore the EntityState of token entities after failed application deletion (thanks @​tedchirvasiu! ❤️)

• The OpenIddict.Client.WebIntegration package now supports Vercel and ID Austria (thanks @​kescherCode! ❤️)

• All the .NET and third-party dependencies have been updated to their latest version.

7.5.0

[!CAUTION]
Earlier today, the ASP.NET team released an out-of-band 10.0.7 update to fix a critical vulnerability in the ASP.NET Core Data Protection library used by OpenIddict and multiple components in ASP.NET Core itself (including the cookie authentication handler). For more information about the CVE-2026-40372 vulnerability and to determine whether your application is affected, read dotnet/announcements#395 and https://devblogs.microsoft.com/dotnet/dotnet-10-0-7-oob-security-update/. Additional information can also be found in dotnet/aspnetcore#66335.

If your application is affected by the CVE-2026-40372 vulnerability, immediate action is strongly advised: not updating impacted applications will leave them vulnerable to chosen-ciphertext and padding oracle attacks, resulting in elevation of privilege attacks being possible.

Recommended actions:

• If possible, review your application/web server/reverse proxy logs to determine whether the security flaw was actively used by malicious actors to leak sensitive cryptographic material or to manipulate legitimate authentication cookies/tokens by changing specific bits in the ciphertext.

• Apply the recommendations listed in Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege dotnet/announcements#395 by revoking all the existing ASP.NET Core Data Protection master keys (e.g using the IKeyManager.RevokeAllKeys() API): doing so will ensure secrets protected before migrating to the fixed Microsoft.AspNetCore.DataProtection version - including authentication cookies produced by the ASP.NET Core cookie authentication handler (and ASP.NET Core Data Protection tokens generated by OpenIddict if the JWT format was opted out) - will be immediately rejected when trying to unprotect them.

• Even if you're not using ASP.NET Core Data Protection as the token format for any type of token in OpenIddict, revoke all the existing OpenIddict tokens using the IOpenIddictTokenManager.RevokeAsync() API to force client applications to acquire new sets of tokens for all their users: doing so will ensure refresh tokens generated by the OpenIddict server will be rejected when trying to redeem them. While this will force users to re-execute an authorization flow and re-authenticate, this step is essential to ensure chains of tokens generated from ClaimsPrincipal instances whose claims were directly copied or indirectly inferred from ambient user identities (typically persisted in authentication cookies protected by ASP.NET Core Data Protection) will not live forever and will be rejected when trying to redeem them.

await using (var scope = app.Services.CreateAsyncScope())
{
    // Revoke all the existing tokens, independently of their current status or type.
    //
    // Note: on EF Core 8.0+ and MongoDB, the process should be very efficient as batch
    // updates are used by default to change the status of the tokens in the database.
    var manager = scope.ServiceProvider.GetRequiredService<IOpenIddictTokenManager>();
    await manager.RevokeAsync(subject: null, client: null, status: null, type: null);
}

This release introduces the following changes:

• The ClaimTypes.NameIdentifier, ClaimTypes.Name and ClaimTypes.Email WS-Federation claims manually added to ProcessAuthenticationContext.MergedPrincipal are now preserved instead of being overwritten by OpenIddict when mapping OpenID Connect/non-standard claims to their WS-Federation equivalent (thanks @​ax0l0tl! ❤️)

• The net8.0, net9.0 and net10.0 versions of the OpenIddict.Client.DataProtection, OpenIddict.Server.DataProtection and OpenIddict.Validation.DataProtection packages now reference the Microsoft.AspNetCore.DataProtection package instead of the Microsoft.AspNetCore.App framework.

• Configuration delegates registered by the web provider integrations now run earlier to ensure invalid options are caught without waiting for IOptionsMonitor<OpenIddictClientOptions>.CurrentValue to be called.

• All the .NET and third-party dependencies have been updated to their latest version.

[!NOTE]
The ASP.NET team recently announced that ASP.NET Core 2.3 will no longer be supported after April 2027, which will result in important TFM and dependencies changes in the next version of OpenIddict. Developers using the OpenIddict packages in .NET Framework applications or in .NET Standard libraries are invited to read these threads and evaluate whether their applications may be affected by these changes:

• Remove ASP.NET Core 2.3 and Entity Framework Core 2.3 support.
• Require .NET Framework 4.8 as the new minimum version.
• Consider removing the UWP and .NET Standard target framework monikers.

7.4.0

This release introduces the following changes:

• The new mTLS-based OAuth 2.0 client authentication feature introduced in the previous version can now be used with the standard client credentials grant.

• The mTLS token binding implementation was updated to support anonymous clients (in this case, the base SelfSignedTlsClientAuthenticationPolicy instance attached to the server options is directly used and the IOpenIddictApplicationManager.GetSelfSignedTlsClientAuthenticationPolicyAsync()/IOpenIddictApplicationManager.ValidateSelfSignedTlsClientCertificateAsync() APIs are not used).

• The OpenIddict.Client.SystemIntegration package now restores the ambient request for marshalled authentication demands so that the OpenIddictRequest instance can be accessed from a custom event handler during a call to the AuthenticateInteractivelyAsync() method.

• A new DisableIssuerParameterValidation flag was introduced to allow disabling the built-in logic used to validate the iss authorization response parameter. Due to Google OIDC IdP returns iss parameter without declaring authorization_response_iss_parameter_supported in metadata openiddict/openiddict-core#2428, this flag is set to true for the Google provider for now.

7.3.0

This release introduces the following changes:

• Mutual TLS authentication is now fully supported by the server and validation stacks for both OAuth 2.0 client authentication and token binding (mTLS support in the client stack was introduced in OpenIddict 6.0). For more information on how to set up mTLS, read Mutual TLS authentication.

• Client secrets are still fully supported but the XML documentation was updated to discourage using them when possible. Instead, developers are encouraged to use either assertion-based client authentication or mTLS-based client authentication, as both offer a higher security level than shared secrets.

• Client-side mTLS support was moved from OpenIddict.Client.SystemNetHttp to OpenIddict.Client and is now a first-class citizen. As part of this task, the existing TlsClientAuthenticationCertificateSelector and SelfSignedTlsClientAuthenticationCertificateSelector options present in OpenIddictClientSystemNetHttpOptions and OpenIddictValidationSystemNetHttpOptions have been marked as deprecated and are no longer used as they didn't allow flowing certificates dynamically (which is required for mTLS token binding using certificates generated on-the-fly). Instead, developers who need to dynamically override the default TLS client certificates selection logic are now invited to create custom event handlers for the ProcessAuthenticationContext event and use the new *EndpointClientCertificate properties.

• OpenIddictClientService now allows attaching custom token request parameters via InteractiveAuthenticationRequest.AdditionalTokenRequestParameters. As part of this change, handling of redirection and post-logout redirection requests by the OpenIddict.Client.SystemIntegration has been improved: token and userinfo requests are no longer sent as part of the callback request itself but when OpenIddictClientService.AuthenticateInteractivelyAsync() is called by the application to finalize the authentication process.

• OpenIddict now uses 4096-bit RSA keys for development certificates and ephemeral keys (see Bump the key size of RSA keys used to generate ephemeral keys and development certificates openiddict/openiddict-core#2415 for more information).

• A new token validation check has been introduced in the client, server and validation stacks to detect when the payload associated with a reference token entry - stolen by a malicious actor from the server database - is directly used instead of the expected reference identifier.

• The osu! service is now supported by the OpenIddict.Client.WebIntegration package (thanks @​gehongyan! ❤️).

• A dedicated prompt setting was added to the Google web provider (thanks @​StellaAlexis! ❤️).

• An incorrect exception message reference was fixed (thanks @​JarieTimmer! ❤️)

• The entire code base was updated to use polyfills when targeting older .NET/.NET Framework/.NET Standard targets.

• All the .NET and third-party dependencies have been updated to the latest versions.

[!WARNING]
Multiple reports indicate that Google is progressively applying a breaking change affecting the Google web provider offered by the OpenIddict.Client.WebIntegration package. For more information on the root cause and the recommended workaround, see openiddict/openiddict-core#2428 and https://issuetracker.google.com/issues/479882107.

7.2.0

This release introduces the following changes:

• Following today's .NET 10.0 release, all the OpenIddict packages now offer a .NET 10.0 target framework moniker referencing .NET Extensions packages version 10.0.

• OpenIddict.Client.WebIntegration now supports Figma.

• The net8.0-android34.0, net8.0-ios18.0, net8.0-maccatalyst18.0 and net8.0-macos15.0 target framework monikers are no longer supported by Microsoft and have been removed from the OpenIddict.Client.SystemIntegration package and the OpenIddict metapackage. Users of the OpenIddict.Client.SystemIntegration package are invited to migrate to .NET 9.0 or 10.0.

[!TIP]
As part of this change, the net9.0-android35.0, net9.0-ios18.0, net9.0-maccatalyst18.0 and net9.0-macos15.0
TFMs have been replaced by net9.0-android, net9.0-ios, net9.0-maccatalyst and net9.0-macos.

New net10.0-android, net10.0-ios, net10.0-maccatalyst and net10.0-macos TFMs have also been added.

• The OpenIddict*Manager.UpdateAsync() methods have been updated to remove cached entries before calling Store.UpdateAsync() to ensure entities are always removed even when the inner store throws an exception.

7.1.0

This release introduces the following changes:

• The GitHub web provider was updated to enforce OAuth 2.0 Proof Key for Code Exchange for all client registrations.

[!TIP]
No change is required to enable PKCE for a specific client application (whether it is a treated as a public or confidential application): updating OpenIddict to 7.1.0 is enough to automatically enforce this security feature.

For more information, read PKCE support for OAuth and GitHub App authentication on the official GitHub blog.

• The HeyBoxChat service is now supported by the OpenIddict.Client.WebIntegration package (thanks @​gehongyan! ❤️)

• New AddGrantTypePermissions()/RemoveGrantTypePermissions() APIs have been added to OpenIddictApplicationDescriptor to simplify adding and removing grant type permissions for custom grants:

var descriptor = new OpenIddictApplicationDescriptor
{
    ClientId = "console",

    // ...
};

descriptor.AddGrantTypePermissions("custom_grant_type");
descriptor.AddScopePermissions("demo_api");

• All the .NET and third-party dependencies have been updated to the latest versions.

7.0.0

For more information about this release, read OpenIddict 7.0 is out.

7.0.0-preview.4

This release introduces the following changes:

• The OAuth 2.0 Token Exchange specification - that was by far the most requested feature by the OpenIddict community - is now fully supported by the client and server stacks:

var result = await _service.AuthenticateWithTokenExchangeAsync(new()
{
    ActorToken = actorToken,
    ActorTokenType = actorTokenType,
    CancellationToken = stoppingToken,
    ProviderName = "Local",
    RequestedTokenType = TokenTypeIdentifiers.AccessToken,
    SubjectToken = subjectToken,
    SubjectTokenType = subjectTokenType
});

var token = result.IssuedToken;
var type = result.IssuedTokenType;

[HttpPost("~/connect/token"), IgnoreAntiforgeryToken, Produces("application/json")]
public async Task<IActionResult> Exchange()
{
    var request = HttpContext.GetOpenIddictServerRequest() ??
        throw new InvalidOperationException("The OpenID Connect request cannot be retrieved.");

    if (request.IsAuthorizationCodeGrantType() || request.IsRefreshTokenGrantType())
    {
        // ...
    }

    else if (request.IsTokenExchangeGrantType())
    {
        // Retrieve the claims principal stored in the subject token.
        //
        // Note: the principal may not represent a user (e.g if the token was issued during a client credentials token
        // request and represents a client application): developers are strongly encouraged to ensure that the user
        // and client identifiers are randomly generated so that a malicious client cannot impersonate a legit user.
        //
        // See https://datatracker.ietf.org/doc/html/rfc9068#SecurityConsiderations for more information.
        var result = await HttpContext.AuthenticateAsync(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);

        // If available, retrieve the claims principal stored in the actor token.
        var actor = result.Properties?.GetParameter<ClaimsPrincipal>(OpenIddictServerAspNetCoreConstants.Properties.ActorTokenPrincipal);

        // Retrieve the user profile corresponding to the subject token.
        var user = await _userManager.FindByIdAsync(result.Principal!.GetClaim(Claims.Subject)!);
        if (user is null)
        {
 ... (truncated)

## 7.0.0-preview.3

This release introduces the following changes:

  - As a preliminary step to the introduction of OAuth 2.0 Token Exchange support in a future 7.0 preview, the entire OpenIddict code base was updated to use new URI-style token type identifiers to represent token types (e.g `urn:ietf:params:oauth:token-type:access_token`). These new identifiers will replace the `token_type_hint`-inspired constants that previous versions of OpenIddict were using in the core, client, server and validation stacks. For more information, read https://github.com/openiddict/openiddict-core/issues/2296.

> [!NOTE]
> While internally massive, this change should be completely transparent for most OpenIddict users. Only advanced users who implement custom handlers for the `GenerateToken`/`ValidateToken` events or use the `ClaimsPrincipal.GetTokenType()`/`ClaimsPrincipal.SetTokenType()` extensions will need to update their code to use the new values.

  - The Discord provider was updated to use the `/users/@​me` endpoint instead of `/oauth2/@​me`, which improves how userinfo claims are represented and returned to the application code (thanks @​egans146 for suggesting this improvement! ❤️).

> [!IMPORTANT]
> This behavior change is breaking: developers are encouraged to review their Discord integration to determine whether their code should be updated to support the new claims representation.

  - New `ClaimsPrincipal.AddClaim()`/`ClaimsPrincipal.AddClaims()`/`ClaimsPrincipal.SetClaim()`/`ClaimsPrincipal.SetClaims()` overloads accepting `System.Text.Json.Nodes.JsonNode` instances have been added to make working with types derived from `JsonNode` easier.

  - An event identifier is now attached to all the logs generated by the OpenIddict core, client, server and validation stacks.

  - A few properties in `OpenIddictClientModels` didn't have an `init` constraint and have been fixed in 7.0.0-preview.3.

> [!TIP]
> Note: this preview also includes all the changes introduced in the OpenIddict 6.3.0 release.

## 7.0.0-preview.2

This release introduces the following changes:

  - All the OpenIddict assemblies have been marked as trimming and Native AOT-compatible (only on .NET 9.0 and higher). For that, several changes had to be made to the OpenIddict core stack:

    - The store resolver interfaces (`IOpenIddict*StoreResolver`) and all their implementations have been removed and the managers have been updated to now directly take an `IOpenIddict*Store<T>` argument instead of an `IOpenIddict*StoreResolver`.

    - All the `OpenIddictCoreOptions.Default*Type` options (e.g `DefaultApplicationType`) have been removed and the untyped managers (`IOpenIddict*Manager`) no longer use options to determine the actual entity type at runtime. Instead, each store integration is now responsible for replacing the `IOpenIddict*Manager` services with a service descriptor pointing to the generic `OpenIddict*Manager<T>` implementation with the correct `T` argument: by default, the default entity types provided by the store are used, but the managers can be re-registered with a different type when the user decides to use different models (e.g via `options.UseEntityFrameworkCore().ReplaceDefaultModels<...>()`).

    - All the managers/store/store resolvers registration APIs offered by `OpenIddictCoreBuilder` have been removed: while they were very powerful and easy-to-use (e.g the `Replace*Manager` methods supported both open and closed generic types and were able to determine the entity type from the base type definition), they weren't AOT-compatible.

    - New AOT-friendly `Replace*Store()` and `Replace*Manager()` APIs have been introduced in `OpenIddictCoreBuilder`. The new `Replace*Manager()` APIs have two overloads that can be used depending on whether you need to register a closed or open generic type:

        ```csharp
        options.ReplaceApplicationManager<
            /* TApplication: */ OpenIddictEntityFrameworkCoreApplication,
            /* TManager: */ CustomApplicationManager<OpenIddictEntityFrameworkCoreApplication>>();
         ```

        ```csharp
        options.ReplaceApplicationManager(typeof(CustomApplicationManager<>));
        ```

    - While they are currently not functional on Native AOT due to EF Core not supporting interpreted LINQ expressions yet, the EF Core stores package has been updated to be ready for AOT: as part of this change, the signature of all the stores has been updated to remove the `TContext` generic argument from the definition. Similarly, the MongoDB C# driver isn't AOT (or even trimming) compatible yet, but the stores have been updated to ensure they only use statically-analyzable patterns.

    - A new `IOpenIddictEntityFrameworkCoreContext` interface containing a single `ValueTask<DbContext> GetDbContextAsync(CancellationToken cancellationToken)` method (similar to what's currently used in the MongoDB integration) has been introduced to allow each to resolve the `DbContext` to use. A default implementation named `OpenIddictEntityFrameworkCoreContext<TContext>` is used by the `OpenIddictEntityFrameworkCoreBuilder.UseDbContext<TContext>()` API to resolve the `TContext` type specified by the user.

    - The `OpenIddictEntityFrameworkCoreBuilder.ReplaceDefaultEntities<...>` API has been preserved - including the overload accepting a single `TKey` parameter but no longer use options internally. Instead, they re-register the untyped `IOpenIddict*Manager` to point to the correct `OpenIddict*Manager<T>` instances depending on the generic types set by the user.

  - For consistency with the Entity Framework Core stores, the `OpenIddictEntityFrameworkBuilder.UseDbContext<TContext>()` API will no longer automatically register the `DbContext` type in the DI container.

  - The authorization endpoint now uses `Cache-Control: no-store` instead of `Cache-Control: no-cache` when generating HTML auto-post form responses (thanks @​matthid! ❤️)

  - OpenIddict 7.0 preview 2 no longer allows dynamically overriding the `prompt` value when using OAuth 2.0 Pushed Authorization Requests.

  > [!IMPORTANT]
  > To prevent login endpoint -> authorization endpoint loops, developers are invited to update their authorization endpoint MVC action to use `TempData` to store a flag indicating whether the user has already been offered to re-authenticate and avoid triggering a new authentication challenge in that case. For instance:
  >
  > ```csharp
  > // Try to retrieve the user principal stored in the authentication cookie and redirect
  > // the user agent to the login page (or to an external provider) in the following cases:
  > //
  > //  - If the user principal can't be extracted or the cookie is too old.
  > //  - If prompt=login was specified by the client application.
  > //  - If max_age=0 was specified by the client application (max_age=0 is equivalent to prompt=login).
  > //  - If a max_age parameter was provided and the authentication cookie is not considered "fresh" enough.
  > //
  > // For scenarios where the default authentication handler configured in the ASP.NET Core
  > // authentication options shouldn't be used, a specific scheme can be specified here.
  > var result = await HttpContext.AuthenticateAsync();
  > if (result is not { Succeeded: true } ||
 ... (truncated)

## 7.0.0-preview.1

This release introduces the following changes:

  - All the ASP.NET Core and Entity Framework Core 2.1 references used for the .NET Framework and .NET Standard TFMs have been replaced by the new 2.3 packages released mid-January (including the .NET Standard 2.1 TFM, that previously referenced unsupported ASP.NET Core 3.1 packages).

> [!IMPORTANT]
> ASP.NET Core 2.3 replaces ASP.NET Core 2.1: as such, it is essential that all ASP.NET Core 2.1 applications running on .NET Framework 4.6.2+ quickly migrate to 2.3 to ensure they keep receiving security patches and critical bug fixes.

> [!CAUTION]
> While it was released as a minor version update, **ASP.NET Core 2.3 is not 100% compatible with ASP.NET Core 2.2**, as none of the changes or APIs introduced in 2.2 - no longer supported since December 2019 - is present in 2.3.
>
> When migrating to OpenIddict 7.0, you'll need to carefully review your dependencies to ensure your application doesn't accidentally depend on any ASP.NET Core 2.2-specific API or package and still runs fine on 2.3.
>
> For more information, read https://devblogs.microsoft.com/dotnet/servicing-release-advisory-aspnetcore-23/ and https://github.com/dotnet/aspnetcore/issues/58598.

  - All the OpenIddict packages now use 8.0 as the minimum .NET Extensions version for the .NET Framework and .NET Standard TFMs, which matches the approach used by the new ASP.NET Core/Entity Framework Core 2.3 packages (that all reference `Microsoft.Extensions.*` 8.0 packages instead of 2.1).

> [!IMPORTANT]
> Initial testing shows that OWIN/Katana or "legacy" ASP.NET 4.6.2+ applications are not negatively impacted by this change: in almost all cases, regenerating (or manually updating the binding redirects if necessary) after migrating to OpenIddict 7.0 should be enough. If you see regressions that may be caused by this change, please post in this thread: https://github.com/openiddict/openiddict-core/issues/2262.

  - As part of the .NET Extensions 2.1 -> 8.0 change, the following improvements have been made:

    - The .NET Framework and .NET Standard TFMs now support `TimeProvider` and the associated properties in `OpenIddictClientOptions`, `OpenIddictCoreOptions`, `OpenIddictQuartzOptions`, `OpenIddictServerOptions` and `OpenIddictValidationOptions` are no longer nullable.
 
    - The .NET Framework and .NET Standard TFMs now support `System.Text.Json.Nodes`, which allows using `JsonNode` with `OpenIddictParameter` on older platforms.

  - Several improvements have been made to the `OpenIddictParameter` primitive:
    - The `OpenIddictParameter` constructors and static operators offering `string?[]?` conversions have been replaced by equivalents taking `ImmutableArray<string?>` or `ImmutableArray<string?>?` parameters, which guarantees that the underlying value wrapped by `OpenIddictParameter` cannot be accidentally mutated after being created.

    - The `OpenIddictRequest.Audiences` and `OpenIddictRequest.Resources` properties have been updated to use `ImmutableArray<string?>?` instead of `string?[]?`, which should prevent unsupported mutations like `context.Request.Audiences[2] = "overridden audience"` (which may or may not work in 6.x depending on the actual CLR type of the parameter value initially wrapped).

    - For similar reasons, `JsonNode` instances are now cloned by `OpenIddictParameter`'s constructor and cloned by the `JsonNode?` conversion operator to prevent accidental mutations. As part of this change, the `OpenIddictRequest.Claims` and `OpenIddictRequest.Registration` properties are now of type `JsonObject` instead of `JsonElement`, which should make these properties easier to use.
 
    - The low-level/untyped `OpenIddictParameter.Value` property has been removed and replaced by a new (hidden) `OpenIddictParameter.GetRawValue()` to encourage users to leverage the built-in conversion operators instead. New `Microsoft.Extensions.Primitives.StringValues` conversion operators have been added to the `OpenIddictParameter` primitive as part of this change.

    - The `ClaimsPrincipal.GetDestinations()`/`ClaimsPrincipal.SetDestinations()` extensions now use `ImmutableDictionary<string, ImmutableArray<string>>` instead of `ImmutableDictionary<string, string[]>` for consistency with the previous changes.

    - The `OpenIddictParameter` structure was updated to use the `JsonNode.DeepEquals()`, `JsonElement.DeepEquals()` or `JsonElement.GetPropertyCount()` APIs when available.

  - The APIs obsoleted in OpenIddict 6.x have been removed.

  - The `net6.0` target framework monikers have been removed.

## 6.4.0

This release introduces the following changes:

  - Support for client authentication - `client_secret_basic`, `client_secret_post` and `private_key_jwt` - was added to the PAR endpoint, which allows rejecting unauthenticated requests without waiting until the token request is processed.
  
  - The `OpenIddict.Client.WebIntegration` package now supports Bungie.net.

  - Parsing of the standard `WWW-Authenticate` HTTP response header by the client and validation stacks was improved.

  - The OpenIddict client OWIN integration was updated to resolve the `IAppBuilder` instance from the DI container: when it is available, the `ICookieManager` attached to the application properties (by the host, typically) is automatically used instead of the default `CookieManager` implementation.

  > [!NOTE]
  > See https://github.com/aspnet/AspNetKatana/pull/486 for more information.

  - The portable, non-OS specific version of the `OpenIddict.Client.SystemIntegration` package can now be used on macOS (in this case, `ASWebAuthenticationSession` is not supported and only the system browser authentication mode can be used).

  - All the .NET and third-party dependencies have been updated to the latest versions.

## 6.3.0

This release introduces the following changes:

  - Two new providers have been added to the list of providers already supported by the `OpenIddict.Client.WebIntegration` package:
    - Contentful (thanks @​jerriep! ❤️)
    - Genesys Cloud (thanks @​MikeAlhayek! ❤️)

  - The web providers source code generator now generates constant strings for the static settings defined by some providers (e.g regions):

```csharp
options.UseWebProviders()
       .AddShopify(options =>
       {
           options.SetClientId("[client identifier]")
                  .SetClientSecret("[client secret]")
                  .SetAccessMode(OpenIddictClientWebIntegrationConstants.Shopify.AccessModes.Online);
       })
       .AddStripeConnect(options =>
       {
           options.SetClientId("[client identifier]")
                  .SetClientSecret("[client secret]")
                  .SetAccountType(OpenIddictClientWebIntegrationConstants.StripeConnect.AccountTypes.Express);
       })
       .AddZoho(options =>
       {
           options.SetClientId("[client identifier]")
                  .SetClientSecret("[client secret]")
                  .SetRegion(OpenIddictClientWebIntegrationConstants.Zoho.Regions.EuropeanUnion);
       });

• The X/Twitter provider was updated to use the new x.com endpoints, which avoids forcing users to authenticate on twitter.com before being redirected to x.com to continue the authorization process on the new domain.

[!NOTE]
As part of this change, the default display name of the X/Twitter provider was changed to X (Twitter).
Developers who prefer a different display name can override the default one using the dedicated options.SetProviderDisplayName(...) API:

options.UseWebProviders()
       .AddTwitter(options =>
       {
           options.SetClientId("[client identifier]")
                  .SetRedirectUri("callback/login/twitter")
                  .SetProviderDisplayName("Twitter");
       });

• The Alibaba/Battle.net/Cognito/Lark/Zoho providers now throw an exception when an invalid region is configured instead of using the default value when an unrecognized region is explicitly set.

• The Zoho provider was updated to support the new United Kingdom region (https://accounts.zoho.uk/).

6.2.1

This release introduces the following changes:

• An issue preventing server configuration responses from being correctly extracted when a partial mtls_endpoint_aliases node is returned but doesn't include all the supported endpoints (thanks @​pctimhk for reporting it! ❤️).

Commits viewable in compare view.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Mikael Weaver (mikaelweave)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Mikael Weaver (mikaelweave)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.89%. Comparing base (b3dcf2b) to head (a3fe73c).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5856      +/-   ##
==========================================
- Coverage   78.70%   77.89%   -0.81%     
==========================================
  Files        1018     1018              
  Lines       37127    37124       -3     
  Branches     5680     5678       -2     
==========================================
- Hits        29219    28918     -301     
- Misses       6509     6787     +278     
- Partials     1399     1419      +20     

see 24 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.